CVE-2023-2817: 
PHP vulnerability analysis and mitigation

A post-authentication stored cross-site scripting (XSS) vulnerability was discovered in Craft CMS versions 4.0.0 through 4.4.11, identified as CVE-2023-2817. The vulnerability was discovered in May 2023 and allows HTML injection, including script tags, into field names which can be triggered when users visit the Categories or Entries pages (Tenable Advisory, NVD).

The vulnerability allows authenticated users to inject HTML and script tags into field names when creating new fields. When these fields are added to a category or section, the malicious payload executes when users access the Categories or Entries pages. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

If exploited, this vulnerability could allow attackers to execute arbitrary JavaScript code in the context of other users' browsers who visit the affected pages. This could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks (Tenable Advisory).

The vulnerability has been fixed in a GitHub commit and was scheduled to be included in the next release after version 4.4.11. Users are advised to upgrade to the patched version when available. The fix involves proper escaping of field labels in the affected components (GitHub Patch).